Cisco Configuring Accounting: Руководство по настройке и отслеживанию пользовательской активности

Restrictions for Configuring Accounting

Configuring Accounting The AAA accounting feature allows the services that users are accessing and the amount of network resources that users are consuming to be tracked. When AAA accounting is enabled, the network access server reports user activity to the TACACS+ or RADIUS security server (depending on which security method is implemented) in the form of accounting records. Each accounting record contains accounting attribute-value (AV) pairs and is stored on the security server. This data can then be analyzed for network management, client billing, and auditing.

Prerequisites for Configuring Accounting, on page 1 Restrictions for Configuring Accounting, on page 1 Information About Configuring Accounting, on page 2 How to Configure AAA Accounting, on page 15 Configuration Examples for AAA Accounting, on page 22 Additional References for Configuring Accounting, on page 25 Feature History for Configuring Accounting, on page 26 Prerequisites for Configuring Accounting The following tasks must be performed before configuring accounting using named method lists: • Enable AAA on the network access server by using the aaa new-model command in global configuration mode.

• Define the characteristics of the RADIUS or TACACS+ security server if RADIUS or TACACS+ authorization is issued. For more information about configuring the Cisco network access server to communicate with the RADIUS security server, see the Configuring RADIUS module. For more information about configuring the Cisco network access server to communicate with the TACACS+ security server, see the Configuring TACACS+ module. Restrictions for Configuring Accounting • Accounting information can be sent simultaneously to a maximum of only four AAA servers. Configuring Accounting 1

Page 1

Named Method Lists for Accounting

Information About Configuring Accounting Named Method Lists for Accounting Similar to authentication and authorization method lists, method lists for accounting define the way accounting is performed and the sequence in which these methods are performed. Named accounting method lists allow particular security protocol to be designated and used on specific lines or interfaces for accounting services. The only exception is the default method list (which is named default). The default method list is automatically applied to all interfaces except those that have a named method list explicitly defined. A defined method list overrides the default method list.

A method list is simply a named list describing the accounting methods to be queried (such as RADIUS or TACACS+), in sequence. Method lists allow one or more security protocols to be designated and used for accounting, thus ensuring a backup system for accounting in case the initial method fails. Cisco IOS software uses the first method listed to support accounting; if that method fails to respond, the Cisco IOS software selects the next accounting method listed in the method list. This process continues until there is successful communication with a listed accounting method, or all methods defined are exhausted.

Note The Cisco IOS software attempts accounting with the next listed accounting method only when there is no response from the previous method. If accounting fails at any point in this cycle--meaning that the security server responds by denying the user access--the accounting process stops and no other accounting methods are attempted. Accounting method lists are specific to the type of accounting being requested. AAA supports seven different types of accounting: Network : Provides information for all PPP, SLIP, or ARAP sessions, including packet and byte counts. EXEC : Provides information about user EXEC terminal sessions of the network access server. Commands :

Provides information about the EXEC mode commands that a user issues. Command accounting generates accounting records for all EXEC mode commands, including global configuration commands, associated with a specific privilege level. Connection : Provides information about all outbound connections made from the network access server, such as Telnet, local-area transport (LAT), TN3270, packet assembler/disassembler (PAD), and rlogin. System : Provides information about system-level events. Resource : Provides “start” and “stop” records for calls that have passed user authentication, and provides “stop” records for calls that fail to authenticate. VRRS :

Provides information about Virtual Router Redundancy Service (VRRS). System accounting does not use named accounting lists; only the default list for system accounting can be defined. Note Configuring Accounting Information About Configuring Accounting Configuring Accounting 2

Page 2

AAA Accounting Methods

When a named method list is created, a particular list of accounting methods for the indicated accounting type are defined. Accounting method lists must be applied to specific lines or interfaces before any of the defined methods are performed. The only exception is the default method list (which is named “default”). If the aaa accounting command for a particular accounting type is issued without specifying a named method list, the default method list is automatically applied to all interfaces or lines except those that have a named method list explicitly defined (A defined method list overrides the default method list). If no default method list is defined, then no accounting takes place.

Note If a named server group used by the aaa accounting command is to be removed, make sure to remove the aaa accounting configuration also from the running configuration. If only the named server group is removed, and the aaa accounting command for that named server group is still present in the running-configuration, it can result in bulk sync failures and continuous reloads on HA devices. If aaa accounting configurations are to be retained in the running configuration, make sure the associated named server group is configured with the correct settings. This section includes the following subsections:

Method Lists and Server Groups A server group is a way to group existing RADIUS or TACACS+ server hosts for use in method lists. The figure below shows a typical AAA network configuration that includes four security servers: R1 and R2 are RADIUS servers, and T1 and T2 are TACACS+ servers. R1 and R2 comprise the group of RADIUS servers. T1 and T2 comprise the group of TACACS+ servers. In Cisco IOS software, RADIUS and TACACS+ server configurations are global. A subset of the configured server hosts can be specified using server groups. These server groups can be used for a particular service.

For example, server groups allow R1 and R2 to be defined as separate server groups (SG1 and SG2), and T1 and T2 as separate server groups (SG3 and SG4). This means either R1 and T1 (SG1 and SG3) or R2 and T2 (SG2 and SG4) can be specified in the method list, which provides more flexibility in the way that RADIUS and TACACS+ resources are assigned. Server groups also can include multiple host entries for the same server, as long as each entry has a unique identifier. The combination of an IP address and a UDP port number creates a unique identifier, allowing different ports to be individually defined as RADIUS hosts providing a specific AAA service.

In other words, this unique identifier enables RADIUS requests to be sent to different UDP ports on a server from the same IP address. If two different host entries on the same RADIUS server are configured for the same service: for example, accounting; the second host entry configured acts as failover backup to the first one. Using this example, if the first host entry fails to provide accounting services, the network access server tries the second host entry configured on the same device for accounting services (The RADIUS host entries are tried in the order in which they are configured).

For more information about configuring server groups and about configuring server groups based on Dialed Number Identification Service (DNIS) numbers, see the “Configuring RADIUS” or “Configuring TACACS+” modules. AAA Accounting Methods The following two methods of accounting are supported: Configuring Accounting Method Lists and Server Groups Configuring Accounting 3

Page 3

Accounting Methods

• TACACS+: The network access server reports user activity to the TACACS+ security server in the form of accounting records. Each accounting record contains accounting AV pairs and is stored on the security server. • RADIUS: The network access server reports user activity to the RADIUS security server in the form of accounting records. Each accounting record contains accounting AV pairs and is stored on the security server. Note Passwords and accounting logs are masked before being sent to the TACACS+ or RADIUS security servers. Use the aaa accounting commands visible-keys command to send unmasked information to the TACACS+ or RADIUS security servers.

Accounting Record Types For minimal accounting, use the stop-only keyword, which instructs the specified method ( RADIUS or TACACS+ ) to send a stop record accounting notice at the end of the requested user process. For more accounting information, use the start-stop keyword to send a start accounting notice at the beginning of the requested event and a stop accounting notice at the end of the event. To stop all accounting activities on this line or interface, use the none keyword. Accounting Methods The table below lists the supported accounting methods. Table 1: AAA Accounting Methods The method argument refers to the actual method the authentication algorithm tries.

Additional methods of authentication are used only if the previous method returns an error, not if it fails. To specify that the authentication should succeed even if all other methods return an error, specify additional methods in the command. For example, to create a method list named acct_tac1 that specifies RADIUS as the backup method of authentication in the event that TACACS+ authentication returns an error, enter the following command:

aaa accounting network acct_tac1 stop-only group tacacs+ group radius To create a default list that is used when a named list is not specified in the aaa accounting command, use the default keyword followed by the methods that are wanted to be used in default situations. The default method list is automatically applied to all interfaces. For example, to specify RADIUS as the default method for user authentication during login, enter the following command: aaa accounting network default stop-only group radius AAA Accounting supports the following methods: Configuring Accounting Accounting Record Types Keyword Description group radius Uses the list of all RADIUS servers for accounting.

group tacacs+ Uses the list of all TACACS+ servers for accounting. group group-name Uses a subset of RADIUS or TACACS+ servers for accounting as defined by the server group group-name. Configuring Accounting 4

Page 4